CHB: add formatstring capability to type inference

Author: sipma

CodeHawk/CHB/bchlib/bCHFunctionInterface.ml

@@ -1350,9 +1350,10 @@ let function_interface_to_bfuntype (fintf: function_interface_t): btype_t =
 let function_type_resolvents_to_bfuntype
       (name: string)
       (resolvents: (register_t * btype_t option * b_attributes_t) list
-       * btype_t option): btype_t =
-  let fintf = default_function_interface name in
-  let (regtypes, returntype) = resolvents in
+       * btype_t option
+       * bool): btype_t =
+  let (regtypes, returntype, varargs) = resolvents in
+  let fintf = default_function_interface ~varargs name in
   let fintf =
     List.fold_left (fun fintf (reg, optty, _) ->
         match optty with

CodeHawk/CHB/bchlib/bCHFunctionInterface.mli

@@ -117,7 +117,9 @@ val bvarinfo_to_function_interface: bvarinfo_t -> function_interface_t
 
 val function_type_resolvents_to_bfuntype:
   string
-  -> ((register_t * btype_t option * b_attributes_t) list * btype_t option)
+  -> ((register_t * btype_t option * b_attributes_t) list
+      * btype_t option
+      * bool)
   -> btype_t
 
 

CodeHawk/CHB/bchlib/bCHFunctionSemantics.ml

@@ -432,6 +432,20 @@ let get_type_arg_mode
                | _ -> None) None predicates
       else
         mode in
+    let mode =
+      if Option.is_none mode then
+        List.fold_left (fun acc p ->
+            match acc with
+            | Some _ -> acc
+            | _ ->
+               match p with
+               | XXInputFormatString (ArgValue param)
+                    when Option.is_some param.apar_index
+                         && (Option.get param.apar_index) = argindex ->
+                  Some ArgInputFormatString
+               | _ -> None) None predicates
+      else
+        mode in
     let mode =
       if Option.is_none mode then
         List.fold_left (fun acc p ->

CodeHawk/CHB/bchlib/bCHLibTypes.mli

@@ -3314,6 +3314,7 @@ type type_arg_mode_t =
   | ArgFunctionPointer
   | ArgScalarValue
   | ArgOutputFormatString
+  | ArgInputFormatString
 
 
 type type_operation_kind_t =
@@ -3334,6 +3335,11 @@ type type_cap_label_t =
   | FlowsToOperation of type_operation_kind_t * bterm_t option
   | FlowsFrom of bterm_t option
 
+  | FOutputFormatString
+  (** parameter is a printf-style format string; implies the function is variadic *)
+  | FInputFormatString
+  (** parameter is a scanf-style format string; implies the function is variadic *)
+
   | FReturn  (** for now limited to the default return register *)
   | Load
   | Store
@@ -3492,6 +3498,9 @@ class type type_constraint_store_int =
              string
              -> (register_t * btype_t option * b_attributes_t) list
                 * btype_t option
+                * bool
+             (** The bool is [true] if any parameter was identified as a
+                 format-string parameter, implying the function is variadic. *)
 
     method resolve_reglhs_type:
              register_t -> string -> string -> btype_t option

CodeHawk/CHB/bchlib/bCHSumTypeSerializer.ml

@@ -549,8 +549,9 @@ object
     | ArgFunctionPointer -> "fp"
     | ArgScalarValue -> "s"
     | ArgOutputFormatString -> "fmt"
+    | ArgInputFormatString -> "ifs"
 
-  method !tags = ["d"; "fmt"; "fp"; "r"; "rw"; "s"; "w"]
+  method !tags = ["d"; "fmt"; "fp"; "ifs"; "r"; "rw"; "s"; "w"]
 
 end
 
@@ -593,6 +594,8 @@ object
     | FlowsToArg _ -> "fta"
     | FlowsToOperation _ -> "fto"
     | FlowsFrom _ -> "ffm"
+    | FOutputFormatString -> "fofs"
+    | FInputFormatString -> "fifs"
     | Load -> "l"
     | Store -> "s"
     | Deref -> "d"
@@ -602,8 +605,8 @@ object
     | OffsetAccessA _ -> "aa"
 
   method !tags = [
-      "a"; "aa"; "d"; "faw"; "ffm"; "fr"; "fs"; "fta"; "fto"; "fx"; "l";
-      "lsb"; "lsh"; "s"; "sa"]
+      "a"; "aa"; "d"; "faw"; "ffm"; "fifs"; "fofs"; "fr"; "fs"; "fta"; "fto";
+      "fx"; "l"; "lsb"; "lsh"; "s"; "sa"]
 
 end
 

CodeHawk/CHB/bchlib/bCHTypeConstraintDictionary.ml

@@ -94,7 +94,8 @@ object (self)
       | ArgDeallocate
         | ArgFunctionPointer
         | ArgScalarValue
-        | ArgOutputFormatString -> (tags, []) in
+        | ArgOutputFormatString
+        | ArgInputFormatString -> (tags, []) in
     type_arg_mode_table#add key
 
   method get_type_arg_mode (index: int): type_arg_mode_t =
@@ -107,6 +108,7 @@ object (self)
     | "d" -> ArgDeallocate
     | "fmt" -> ArgOutputFormatString
     | "fp" -> ArgFunctionPointer
+    | "ifs" -> ArgInputFormatString
     | "r" -> ArgDerefRead (getsize ())
     | "rw" -> ArgDerefReadWrite (getsize ())
     | "s" -> ArgScalarValue
@@ -155,6 +157,8 @@ object (self)
       | FlowsFrom t ->
          (tags,
           [match t with Some t -> id#index_bterm t | _ -> (-1)])
+      | FOutputFormatString -> (tags, [])
+      | FInputFormatString -> (tags, [])
       | Load -> (tags, [])
       | Store -> (tags, [])
       | Deref -> (tags, [])
@@ -185,6 +189,8 @@ object (self)
     | "fto" ->
        FlowsToOperation (type_operation_kind_mfts#fs (t 1),
                          if (a 0) = (-1) then None else Some (id#get_bterm (a 0)))
+    | "fofs" -> FOutputFormatString
+    | "fifs" -> FInputFormatString
     | "a" -> OffsetAccess (a 0, a 1)
     | "aa" -> OffsetAccessA (a 0, a 1)
     | s -> raise_tag_error name s type_cap_label_mcts#tags

CodeHawk/CHB/bchlib/bCHTypeConstraintStore.ml

@@ -564,7 +564,9 @@ object (self)
 
   method resolve_function_type
            (faddr: string)
-         : (register_t * btype_t option * b_attributes_t) list * btype_t option =
+         : (register_t * btype_t option * b_attributes_t) list
+           * btype_t option
+           * bool =
     let evaluation = self#evaluate_function_type faddr in
     let result = H.create 4 in
     let returnresult = ref None in
@@ -752,7 +754,15 @@ object (self)
          "return: " ^ (match !returnresult with
                        | Some ty -> btype_to_string ty
                        | _ -> "?")] in
-    (result, !returnresult)
+    let varargs =
+      H.fold (fun _k capslists acc ->
+          acc
+          || List.exists
+               (fun caps ->
+                 List.mem FOutputFormatString caps
+                 || List.mem FInputFormatString caps) capslists)
+        capresult false in
+    (result, !returnresult, varargs)
 
   method resolve_reglhs_type
            (reg: register_t) (faddr: string) (iaddr: string): btype_t option =

CodeHawk/CHB/bchlib/bCHTypeConstraintUtil.ml

@@ -74,6 +74,9 @@ let _type_arg_mode_compare (m1: type_arg_mode_t) (m2: type_arg_mode_t): int =
   | (ArgScalarValue, _) -> -1
   | (_, ArgScalarValue) -> 1
   | (ArgOutputFormatString, ArgOutputFormatString) -> 0
+  | (ArgOutputFormatString, _) -> -1
+  | (_, ArgOutputFormatString) -> 1
+  | (ArgInputFormatString, ArgInputFormatString) -> 0
 
 
 let type_cap_label_compare (c1: type_cap_label_t) (c2: type_cap_label_t) =
@@ -134,6 +137,12 @@ let type_cap_label_compare (c1: type_cap_label_t) (c2: type_cap_label_t) =
   | (_, OffsetAccess _) -> 1
   | (OffsetAccessA (n1, m1), OffsetAccessA (n2, m2)) ->
      Stdlib.compare (n1, m1) (n2, m2)
+  | (OffsetAccessA _, _) -> -1
+  | (_, OffsetAccessA _) -> 1
+  | (FOutputFormatString, FOutputFormatString) -> 0
+  | (FOutputFormatString, _) -> -1
+  | (_, FOutputFormatString) -> 1
+  | (FInputFormatString, FInputFormatString) -> 0
 
 
 let type_arg_mode_to_string (m: type_arg_mode_t) =
@@ -149,6 +158,7 @@ let type_arg_mode_to_string (m: type_arg_mode_t) =
   | ArgFunctionPointer -> "fp"
   | ArgScalarValue -> "sv"
   | ArgOutputFormatString -> "ofs"
+  | ArgInputFormatString -> "ifs"
 
 
 let type_operation_kind_to_string (op: type_operation_kind_t) =
@@ -180,6 +190,8 @@ let type_cap_label_to_string (c: type_cap_label_t) =
      ^ (type_operation_kind_to_string op)
      ^ (optbterm_to_string t)
   | FlowsFrom t -> "flowsfrom" ^ (optbterm_to_string t)
+  | FOutputFormatString -> "output-format-string"
+  | FInputFormatString -> "input-format-string"
   | Load -> "load"
   | Store -> "store"
   | Deref -> "deref"
@@ -469,6 +481,14 @@ let add_stack_address_capability (offset: int) (tv: type_variable_t)
   add_capability [FLocStackAddress offset] tv
 
 
+let add_output_format_string_capability (tv: type_variable_t): type_variable_t =
+  add_capability [FOutputFormatString] tv
+
+
+let add_input_format_string_capability (tv: type_variable_t): type_variable_t =
+  add_capability [FInputFormatString] tv
+
+
 let convert_function_capabilities_to_attributes
       (paramindex: int) (caps: type_cap_label_t list): b_attributes_t =
   let type_arg_mode_to_cons_attrparam (m: type_arg_mode_t) =
@@ -484,6 +504,7 @@ let convert_function_capabilities_to_attributes
     | ArgFunctionPointer -> ACons ("fp", [])
     | ArgScalarValue -> ACons ("sv", [])
     | ArgOutputFormatString -> ACons ("printf_format_string", [])
+    | ArgInputFormatString -> ACons ("scanf_format_string", [])
   in
   let result = new CHUtils.IntCollections.set_t in
   let _ =
@@ -498,6 +519,14 @@ let convert_function_capabilities_to_attributes
                     AInt argindex;
                     type_arg_mode_to_cons_attrparam mode]) in
            result#add (bcd#index_attribute attr)
+        | FOutputFormatString ->
+           let attr =
+             Attr ("format", [ACons ("printf", []); AInt paramindex; AInt 0]) in
+           result#add (bcd#index_attribute attr)
+        | FInputFormatString ->
+           let attr =
+             Attr ("format", [ACons ("scanf", []); AInt paramindex; AInt 0]) in
+           result#add (bcd#index_attribute attr)
         | _ -> ()) caps in
   List.map bcd#get_attribute result#toList
 

CodeHawk/CHB/bchlib/bCHTypeConstraintUtil.mli

@@ -245,6 +245,22 @@ val add_flows_from_capability:
 val add_stack_address_capability: int -> type_variable_t -> type_variable_t
 
 
+(** [add_output_format_string_capability tv] returns a new type variable that
+    appends an [FOutputFormatString] capability to [tv], which is expected to
+    already carry an [FRegParameter] prefix (set via [add_freg_param_capability]).
+    Indicates that the named parameter is a printf-style format string parameter
+    and thus the enclosing function is variadic. *)
+val add_output_format_string_capability: type_variable_t -> type_variable_t
+
+
+(** [add_input_format_string_capability tv] returns a new type variable that
+    appends an [FInputFormatString] capability to [tv], which is expected to
+    already carry an [FRegParameter] prefix (set via [add_freg_param_capability]).
+    Indicates that the named parameter is a scanf-style format string parameter
+    and thus the enclosing function is variadic. *)
+val add_input_format_string_capability: type_variable_t -> type_variable_t
+
+
 val drop_capability: type_cap_label_t -> type_variable_t -> type_variable_t
 
 

CodeHawk/CHB/bchlib/bCHVersion.ml

@@ -95,8 +95,8 @@ end
 
 
 let version = new version_info_t 
-  ~version:"0.6.0_20260601"
-  ~date:"2026-06-01"
+  ~version:"0.6.0_20260610"
+  ~date:"2026-06-10"
   ~licensee: None
   ~maxfilesize: None
   ()